CVE-2021-37102

published 2021-11-23

CVE-2021-37102: There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs…

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, 8.0.0.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—
huawei	fusioncompute	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77